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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

1. (Currently Amended) A method comprising: 

presenting a graphical user interface (GUI) for a capture system, wherein the GUI 
comprises one or more views including: 

a search editor view to enable parameters of a search of tags of objects captured 
by the capture system to be defined, the capture system configured to intercept data 
from data streams, reconstruct the data, and store network transmitted objects 
according to a capture rule that defines which objects are to be captured by the capture 
system, wherein each tag is associated with at least one captured object and includes 
relevant information that describes the at least one object , and wherein the capture 
rule is part of a default rule set for the capture system configured to monitor 
network traffic and capture the objects: and 

a capture rule view to enable parameters of the capture rule to be defined. 

2. (Previously Presented) The method of claim 1, wherein the parameters definable 
through the search editor view include both indexed and non-indexed search criteria. 

3. (Previously Presented) The method of claim 1, wherein the definable search editor view 
parameters include one or more of a plurality of search criteria, the search criteria comprising: 

a content type, 
a protocol, 
a keywords, and 
a word pattern. 
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4. (Previously Presented) The method of claim 3, wherein the search criteria further 
include a source address, a destination address, a size range, and a temporal range. 

5. (Previously Presented) The method of claim 1, wherein the definable parameters of the 
search editor view specify one or more of a plurality of search criteria, the search criteria 
comprising: 

an email source, 
an email destination, 
an email carbon copy, 
an email subject, and 
message keywords. 



6-21. (Canceled) 
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22. (Withdrawn) A capture system comprising: 

a packet capture module to extract data packets from a data stream; 

an object assembly module to reconstruct a flow of at least one object from the 
extracted data packets; 

an object classification module to classify the at least one object and to deconstruct the 
flow into at least one object; 

an object store module to store the at least one object; and 

a graphical user interface (GUI) module to provide a GUI including a search view to allow 
for the authoring, editing, scheduling, and viewing of searches of stored tags. 
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23. (Withdrawn) A method comprising: 
capturing data packets from a data stream; 

reconstructing said data packets into a copy of an original object; 

determining if the copy of the original object should be stored based on a capture rule; 

generating a tag for the copy of the original object; 

storing the copy of the original object and the tag if it is determined that the copy of the 
original object should be stored based on the capture rule; 

discarding the copy of the original object if it is determined that the copy of the original 
object should not be stored based on the capture rule; and 

generating a graphical user interface (GUI), the GUI including a search view to allow for 
the authoring, editing, scheduling, and viewing of searches of stored tags. 

24. (Withdrawn) The method of claim 23, further comprising: 

discarding the tag if it is determined that the copy of the original object should not be 
stored based on the capture rule. 

25. (Previously Presented) The method of claim 1, wherein the search is of tags of stored 
objects. 



26. (Canceled) 
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27. (Currently Amended) A computer readable medium having stored thereon data 
representing instructions that, when executed by a processor, cause the processor to perform 
operations comprising: 

presenting a graphical user interface (GUI) for a capture system, wherein the GUI 
comprises one or more views including: 

a search editor view to enable parameters of a search of tags of objects captured 
by the capture system to be defined, the capture system configured to intercept data 
from data streams, reconstruct network transmitted objects, and store network 
transmitted objects according to a capture rule that defines which objects are to be 
captured by the capture system, wherein each tag is associated with at least one 
captured object and includes relevant information that describes the at least one object^ 
and wherein the capture rule is part of a default rule set for the capture system 
configured to monitor network traffic and capture the objects: and 

a capture rule view to enable parameters of the capture rule to be defined. 

28. (Previously Presented) The computer readable medium of claim 27, wherein the 
parameters definable through the search editor view include both indexed and non-indexed 
search criteria. 

29. (Previously Presented) The computer readable medium of claim 27, wherein the 
definable search editor view parameters include one or more of a plurality of search criteria, 
the search criteria comprising: 

a content type, 
a protocol, 
a keyword, and 
a word pattern. 
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30. (Previously Presented) The computer readable medium of claim 29, wherein the search 
criteria further include a source address, a destination address, a size range, and a temporal 
range. 

31. (Previously Presented) The computer readable medium of claim 27, wherein the 
definable parameters of the search editor view specify one or more of a plurality of search 
criteria, the search criteria comprising: 

an email source, 
an email destination, 
an email carbon copy, 
an email subject, and 
message keywords. 

32. (Previously Presented) The computer readable medium of claim 27, wherein the search 
is of tags of stored objects. 

33. (Previously Presented) The method of claim 1, wherein the relevant information that 
describes the at least one object includes one or more of a plurality of fields, the fields 
comprising: 

a protocol, 

an instance, 

a content type, 

an encoding, 

a capture rule, 

an object signature, and 

a tag signature. 



34. (Cancelled) 



